ci: build the backend image in its own workflow and shorten the panel offer wait [CI]

.woodpecker/dev-backend-image.yml

@@ -0,0 +1,46 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+      # 要拿到 tag 才算得出开发版本号（ci/version.sh：自最近 tag 的提交数）
+      tags: true
+
+when:
+  - event: push
+    branch: main
+    evaluate: 'CI_COMMIT_MESSAGE contains "[CI]"'
+
+# 后端镜像：和 dev-image.yml（Agent 镜像）并行，各自的 restore 只还原自己要用的依赖。构建好之后、推送之前由 ci/wait-for-checks.sh 等 verify 和 web-build。
+# 前端用 web-build workflow 的产物（ci/shared-web.sh）。
+
+concurrency: 1
+
+steps:
+  - name: restore-linux-dependencies
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/woodpecker/cache/nuget/packages
+    commands:
+      - python3 ci/guard-step.py restore-backend-dependencies 1800 bash ci/restore-linux-dependencies.sh dev-backend
+    depends_on: []
+
+  - name: build-linux-amd64-backend
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/woodpecker/cache/nuget/packages
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      RELEASE_API_URL: https://mo.oeo.one
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - python3 ci/guard-step.py build-linux-amd64-backend 1800 bash ci/build-dev-image.sh backend
+    depends_on:
+      - restore-linux-dependencies

.woodpecker/dev-image.yml

@@ -15,8 +15,10 @@ when:
     branch: main
     evaluate: 'CI_COMMIT_MESSAGE contains "[CI]"'
 
+# Agent 镜像：三个 RID 的 Agent 构建，构建完发布。后端镜像在 dev-backend-image.yml 里并行构建：Woodpecker 一个 workflow 里的步骤按依赖深度分层，
+# 下一层要等上一层全部结束，发布放在后端构建（最慢）后面会白等。
 # 镜像构建和 verify（后端快速测试）、web-build 并行跑，不再等它们：构建好之后、推送之前由 ci/wait-for-checks.sh 等这两个 workflow 都成功
-# （任何一个失败就不推；提交信息写 [SKIP TESTS] 只跳过后端测试，verify 照样是成功）。机器有 6 个 workflow 槽（WOODPECKER_MAX_WORKFLOWS），三个同时跑放得下。
+# （任何一个失败就不推；提交信息写 [SKIP TESTS] 只跳过后端测试，verify 照样是成功）。机器有 6 个 workflow 槽（WOODPECKER_MAX_WORKFLOWS），四个同时跑放得下。
 
 concurrency: 1
 
@@ -26,25 +28,9 @@ steps:
     environment:
       NUGET_PACKAGES: /home/justme/woodpecker/cache/nuget/packages
     commands:
-      - python3 ci/guard-step.py restore-linux-dependencies 3600 bash ci/restore-linux-dependencies.sh dev
+      - python3 ci/guard-step.py restore-linux-dependencies 3600 bash ci/restore-linux-dependencies.sh dev-agent
     depends_on: []
 
-  - name: build-linux-amd64-backend
-    image: bash
-    environment:
-      NUGET_PACKAGES: /home/justme/woodpecker/cache/nuget/packages
-      ZOT_REGISTRY: registry.oeo.one
-      ZOT_USERNAME: justme
-      ZOT_SECRET:
-        from_secret: zot_secret
-      RELEASE_API_URL: https://mo.oeo.one
-      RELEASE_SIGNING_KEY:
-        from_secret: release_signing_key
-    commands:
-      - python3 ci/guard-step.py build-linux-amd64-backend 1800 bash ci/build-dev-image.sh backend
-    depends_on:
-      - restore-linux-dependencies
-
   - name: build-arm64-agent-musl
     image: bash
     environment:

ci/publish-release-offer.sh

@@ -14,7 +14,7 @@ if [[ -n "${RELEASE_API_URL:-}" ]]; then
   python3 -c 'import json,sys; print(json.dumps({"manifest": open(sys.argv[1]).read(), "signature": open(sys.argv[2]).read()}))' \
     "$outdir/manifest.json" "$outdir/manifest.sig" > "$outdir/payload.json"
   response="$outdir/response.json"
-  status="$(curl --silent --show-error --retry 3 --max-time 30 -o "$response" -w '%{http_code}' -X POST "${RELEASE_API_URL%/}/api/release/offer" \
+  status="$(curl --silent --show-error --max-time 10 -o "$response" -w '%{http_code}' -X POST "${RELEASE_API_URL%/}/api/release/offer" \
     -H 'Content-Type: application/json' --data-binary "@$outdir/payload.json" 2>/dev/null || true)"
   if [[ "$status" == 2* ]]; then
     echo "also registered the signed $component release with the panel ($channel)"

ci/restore-linux-dependencies.sh

@@ -2,8 +2,8 @@
 # Resolve Backend and Agent dependencies once before Linux build tasks start.
 set -euo pipefail
 
-mode="${1:?usage: restore-linux-dependencies.sh <dev|release|agent>}"
-case "$mode" in dev|release|agent) ;; *) exit 2 ;; esac
+mode="${1:?usage: restore-linux-dependencies.sh <dev-backend|dev-agent|release|agent>}"
+case "$mode" in dev-backend|dev-agent|release|agent) ;; *) exit 2 ;; esac
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 work="$root/.release/linux-restore"
 base_home="/home/justme/woodpecker/buildah-home/linux-agent"
@@ -24,15 +24,15 @@ trap cleanup EXIT
 source "$root/ci/version.sh"
 export NUGET_PACKAGES="${NUGET_PACKAGES:-/home/justme/woodpecker/cache/nuget/packages}"
 mkdir -p "$NUGET_PACKAGES"
-if [[ "$mode" == dev ]]; then
+if [[ "$mode" == dev-* ]]; then
   [[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *'[CI]'* ]] || exit 2
 else
   [[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || exit 2
 fi
 moshiro_apply_version
 
-if [[ "$mode" == dev || "$mode" == release ]]; then
-  if [[ "$mode" == dev ]]; then
+if [[ "$mode" == dev-backend || "$mode" == release ]]; then
+  if [[ "$mode" == dev-backend ]]; then
     backend_rids=(linux-x64)
   else
     backend_rids=(linux-x64 linux-arm64)
@@ -52,7 +52,7 @@ if [[ "$mode" == dev || "$mode" == release ]]; then
   done
 fi
 
-if [[ "$mode" == dev || "$mode" == agent ]]; then
+if [[ "$mode" == dev-agent || "$mode" == agent ]]; then
   [[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || { echo 'CI_COMMIT_SHA must be a full commit SHA' >&2; exit 2; }
   mkdir -p "$work" "$base_home"
   exec 9> "$base_home/.lock"

docs/ops/deployment.md

@@ -112,7 +112,7 @@ Pull request 和 `main` 的 push 会跑三个 workflow：
 
 - `verify`：后端的快测试（除了标了 `Category=Slow` 的全部，约 20 秒）；
 - `web-build`：前端构建和 CSS 检查，和 `verify` 并行（约 15 秒）；
-- 标了 `Category=Slow` 的端到端测试（真实时间的 Hy2 阶梯、IPv6 和真探针的几条，一百来秒）：带 `[CI]` 的推送，在 `dev-image` 里等三个镜像都构建、推送完再跑（不和 NativeAOT 编译抢内存——同时跑过一次，Backend 的 AOT 编译被内存不足杀掉了）；PR 和没带 `[CI]` 的推送由 `e2e` workflow 在 `verify` 之后跑。失败照样红，但不影响已经推出去的镜像。
+- 标了 `Category=Slow` 的端到端测试（真实时间的 Hy2 阶梯、IPv6 和真探针的几条，一百来秒）：只在 PR 和没带 `[CI]` 的推送上由 `e2e` workflow 在 `verify` 之后跑；带 `[CI]` 的推送只出镜像。
 
 后端测试用增量编译（`ci/verify-backend.sh`）：源码按内容同步到 CI 主机上一个固定目录，保留 `obj/bin`，只重编译变了的项目；同一时间只有一条流水线用这份缓存。失败的测试会单独重跑（最多两次），重跑通过算通过。给新的慢测试打标记：`[Trait("Category", "Slow")]`。